Sparrow Bitcoin Privacy Wallet Releases Update After AI Flags Security Issues
Privacy-focused Bitcoin wallet Sparrow Wallet released version 2.5.4 on Thursday following an AI-assisted code review that produced the majority of the update’s fixes, developer Craig Raw told Decrypt.
AI Review Prompted by Evolving Threat Landscape
Raw said the review was driven primarily by the release of unrestricted Chinese AI models and the new ability to search large codebases for potential exploits. He did not identify the specific models used to review Sparrow’s code.
The initiative followed a July attack that exploited a flaw in Coldcard’s seed-generation code. That vulnerability allowed an attacker to reconstruct private keys without physical access to the devices. Coldcard manufacturer Coinkite stated it believed AI may have helped the attacker discover the flaw.
“Obviously, the Coldcard incident triggered a great deal of activity within the Bitcoin space itself, but it was really the sudden arrival of the capability to search large codebases for potential exploits,”
Raw told Decrypt.
Asked which fixes originated from the AI-assisted review, Raw replied:
“Most of them—it was the bulk of the work in this release.”
Key Security Enhancements in Version 2.5.4
Launched in 2020, Sparrow Wallet provides privacy and security tools such as coin control, Tor support, and hardware wallet and air-gapped signing capabilities to keep private keys offline.
The official changelog lists dozens of security changes designed to reduce trust in external services. Highlights include:
- Verification that transactions returned by Electrum servers match the requested data.
- Cryptographic proof checks that transactions were recorded in a Bitcoin block.
- Verification of the latest chain block before displaying transactions as confirmed.
BitBox02 hardware-wallet security is strengthened, now requiring firmware version 9.4.0 or later and anti-klepto protection to prevent a compromised device from leaking private-key information during signing.
Additional changes affect Ledger, Trezor, and Keycard device handling, multisignature wallets, Payjoin, wallet imports, and partially signed Bitcoin transactions. The update also redacts Bitcoin Core credentials and other secrets from debug logs, restricts access to wallet and backup directories, and closes local DNS leaks when using Tor.
No Evidence of Exploitation, but Update Recommended
Raw emphasized that the volume of changes does not indicate an immediate threat to user funds.
“Nothing was found that was likely to put funds at risk,”
he said, adding that he personally reviewed each issue.
“Every issue raised was carefully reviewed by myself, and multiple independent AI passes,”
Raw stated.
He reported no evidence that the issues were exploited or that Sparrow users were affected, and considers such exploitation unlikely. Nevertheless, he recommends installing the update, while acknowledging that users with air-gapped setups may hesitate to modify their configurations.
“I always want people to update, and I recommend it—but of course there are those who are perhaps running Sparrow on air-gapped computers who are reluctant to make any changes to their setup,”
Raw said.
“In these cases, I would encourage reading the changelog regardless to make an informed choice.”
Broader AI Security Push in Bitcoin Ecosystem
Sparrow’s review reflects a wider trend across the Bitcoin ecosystem, where developers are increasingly using AI to scan wallets, payment protocols, and code libraries for vulnerabilities before attackers can exploit them.
No Comments